aio-libs/aiohttp · Security
AIOHTTP has CRLF injection through multipart part content type header construction
- GHSA ID
- GHSA-2vrm-gr82-f7m5
- CVE ID
- CVE-2026-34514
- Severity
- low
- Published
- Updated
- CVSS v4
- 2.7 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U
Description
Summary
An attacker who controls the content_type parameter in aiohttp could use this to inject extra headers or similar exploits.
Impact
If an application allows untrusted data to be used for the multipart content_type parameter when constructing a request, an attacker may be able to manipulate the request to send something other than what the developer intended.
Patch: https://github.com/aio-libs/aiohttp/commit/9a6ada97e2c6cf1ce31727c6c9fcea17c21f6f06
CWEs
- CWE-113 · Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')
References
- https://github.com/aio-libs/aiohttp/security/advisories/GHSA-2vrm-gr82-f7m5 ↗
- https://github.com/aio-libs/aiohttp/commit/9a6ada97e2c6cf1ce31727c6c9fcea17c21f6f06 ↗
- https://nvd.nist.gov/vuln/detail/CVE-2026-34514 ↗
- https://github.com/aio-libs/aiohttp/releases/tag/v3.13.4 ↗
- https://github.com/advisories/GHSA-2vrm-gr82-f7m5 ↗